Ardagh Group Privacy Notice for California Consumers

1. WHY WE COLLECT YOUR DATA?

The California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA), gives California residents the right to know what Personal Information Ardagh Group S.A. (“Ardagh Group,” “we,” “us,” or “our”) collects about them, including whether it is being sold or disclosed to third parties. The CCPA and CPRA also grant certain rights to California residents, including the right to delete their Personal Information (subject to certain exceptions) and the right to prevent Ardagh Group from selling their Personal Information. Companies are also prohibited from retaliating or discriminating against consumers for exercising their rights under the CCPA and CPRA. This Notice provides the information required under the CCPA and CPRA and applies to both Ardagh Group’s online and offline activities.

Please note that our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. DISCLOSURES OF YOUR PERSONAL DATA

To learn about the categories of personal information we have collected, in addition to the purposes for collecting and sharing Personal Information described below, Ardagh Group collects and discloses any and all Personal Information (regardless of your relationship or interaction with us) as necessary or appropriate to: comply with laws and regulations; monitor, investigate potential breaches of, and enforce compliance with Ardagh Group policies and procedures and legal and regulatory requirements; comply with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and exercise or defend the legal rights of Ardagh Group and its employees, affiliates, customers, contractors, and agents.

We may have to share your personal information with internal third parties and external third parties for the purposes set out in the table below.

Internal Third Parties include subsidiaries of Ardagh Group S.A. who provide (a) IT and system administration services, and (b) undertake reporting activities; and employees within the Sales/ Communications/ Marketing/ Investor Relations teams who have access to the personal information to carry out the purposes described below.
External Third Parties include service providers who provide IT, email, website and system administration services; professional advisers including lawyers, finance providers, auditors and insurers who provide consultancy, financing, legal, insurance and accounting services; and regulators and other authorities who require reporting of processing activities in certain circumstances.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

3. WHAT DO WE MEAN BY PERSONAL INFORMATION?

In this Notice, “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information includes, but is not limited to, the categories of personal information identified that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household.

Personal information includes Sensitive Personal Information. In this Notice, “Sensitive Personal Information” includes Personal Information that reveals, among other things, social security number, driver’s license number, state identification card number, or passport number, racial or ethnic origin, union membership, or the contents of a consumer’s mail, email, and text messages, unless Ardagh Group is the intended recipient of the communication. Sensitive Personal Information also includes information concerning consumers’ health, sex life, or sexual orientation. Personal Information and Sensitive Personal Information does not include data where the identity has been removed (anonymous data).

We collect Personal Information from you (whether because you submit that information to us or in the course of our interaction with you), from your device (as you interact with our website or other online resources), and from publicly available sources or third parties who have collected information about you. In the chart below, we use the following categories of Personal Information to describe the Personal Information we collect, use, and share about consumers:

Commercial Information	Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Financial Information	Financial information, including bank account number, credit or debit card number, billing personnel, or other financial information.
Identifiers	Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, company name, job title or other similar identifiers.
Inferences	Inferences drawn from any of the information listed above to create a profile about an individual reflecting the individual’s preferences, including preferences in receiving marketing materials such as newsletters and/or investor relations subscriptions and communication preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. (e.g., predications about an individual’s preferences or tendencies).
Geolocation Data	An individual’s precise geolocation data.
Network Activity Data	Internet or other electronic network activity information, such as browser type and version, browser plug-in types and version, browsing history, search history, login data, operating system and platform and other technology on the devices you use to access a website, all information about your usage of data, including information about how you use our website, products and services, and information regarding an individual’s interaction with an internet website, application, or advertisement.
Professional Information	An individual’s professional or employment-related information, including company name, job title, professional billing address, professional delivery address, professional email address and telephone numbers.

4. HOW WE USE YOUR PERSONAL DATA

It is Ardagh’s policy not to sell any of our visitors’ personal information to non-affiliated companies. Ardagh’s current intent is to use information that is collected for the internal purposes of itself and of its affiliates, including, but not limited to, improving its websites and its operations, for providing targeted information or correspondence, such as evaluation requests, and for sharing with third party companies to perform such services for us. These third-party companies are legally required to use the information only for the purposes requested by Ardagh. Cookies may be used to collect such information. Ardagh does not does knowingly collect Personal Information from children under 13.

Information Gathering

We collect two types of information from you when you visit our Website: (1) information that is passively collected through your use of our Website, and (2) information you provide to receive requested information and/or services.

Passively Collected Information

When you visit our Website, we may automatically collect network activity data to better understand which parts of our Website are most popular, to detect problems with our Website, and monitor the Website’s security. Similar to many other major websites, our Website may automatically collect and track network activity data, including non-personally identifiable information, such as the type of web browser you use, the type of operating system you use, the name of your Internet Service Provider, and the URL from which you accessed the Website. We may use cookies and other tracking technologies for this purpose. Cookies are pieces of information that a website transfers to a visitor’s computer for record-keeping purposes. Cookies make web surfing easier for you by saving your preferences. Cookies also help us understand how and when our site is used, including total number of visitors and pages viewed, when enables us to provide services better tailored to your needs. We never save passwords or personal information in cookies.

Most browsers are initially set up to accept cookies. You can reset your browser to refuse all cookies, or to indicate when a cookie is being sent. Please note that some parts of the Ardagh Website will not function properly or may be considerably slower if you refuse cookies.

We may employ Google Analytics and Google Demographics, a web analytics service provided by Google, Inc. (“Google”), to help us understand the use and functioning of our site. Google Analytics uses cookies to analyze use patterns and may collect information about your use of the Website, including your IP address. More information on Google Analytics can be found, here. If you would like to opt-out of having your data used by Google Analytics, please use the Google Analytics opt-out available here: https://tools.google.com/dlpage/gaoptout/. Please note that we make no representations regarding the functionality of Google opt-out mechanisms, and further, opting out of Google Analytics will not preclude the use of your data by other analytics services that we may use.

5. YOUR LEGAL RIGHTS

You, as a California resident, may have the following rights under the CCPA and CPRA with respect to your Personal Information

Right to Notice Before or at the time we collect Personal Information from you, you have the right to receive notice of the Personal Information to be collected and the purposes for which we use it. This Notice is intended to satisfy this requirement.
You also have the right to request that we disclose to you the categories of personal information we have collected about you in the preceding 12 months, along with the categories of sources from which the personal information was collected, the purpose for collecting or selling the personal information, the categories of third parties with whom we shared the personal information, and the categories of third parties to whom we sold the personal information.
Right of Access. You have the right to request that we disclose or provide you with access to the specific pieces of Personal Information we have collected about you in the preceding 12 months.
Right to Correct Inaccurate Personal Information. You have the right to request that we correct any Personal Information we collect from you if it is inaccurate.
Right to Deletion. You have the right to request that we delete the Personal Information we collect from you. However, in certain situations we are not required to delete your Personal Information, such as when the information is necessary in order to complete the transaction for which the Personal Information was collected, to provide a good or service requested by you, to comply with a legal obligation, to engage in research, to secure our websites or other online services, or to otherwise use your Personal Information internally in a lawful manner that is compatible with the context in which you provided the information.
Right to Opt-Out of the Sale of Personal Information. If Ardagh Group sells your Personal Information to third parties, you have the right, at any time, to direct us not to sell your personal information. To exercise this right, please click on the “Do Not Sell My Personal Information” button below or on any Ardagh Group webpage where the button is present. Ardagh Group does not sell the Personal Information of minors under 16 years of age without affirmative authorization.
Right Not to Be Subject to Discrimination. You have the right to be free from discrimination or retaliation for exercising any of your rights under the CCPA and CPRA as described above.

You can exercise your rights by calling 833-737-0006 or by emailing Privacy.NA@ardaghgroup.com.

NOTICE FOR OUR BUSINESS CUSTOMERS: Because we do not provide services directly to individuals, and instead provide goods and services exclusively on a business-to-business basis, once you enter a business relationship with us, your rights under the CCPA and CPRA will change. This notice is not intended to and does not describe our practices or your rights about the information we collect during our relationship with our business customers. For more information, please contact us using the phone number or email provided below.

VERIFICATION: We value the security and confidentiality of your Personal Information. Therefore, if you exercise your right to notice, right of access, or right to deletion, we must first verify your identity to make sure that you are the person about whom we have collected Personal Information.

You may also authorize someone else to submit these requests on your behalf. To do so, you may designate directly with us another person who may act on your behalf, or ask the authorized agent to provide us with a copy of your written permission and a scanned copy of their own government-issued ID.

6. OTHER INFORMATION

You have the right to be free from discrimination or retaliation for exercising any of rights under the CCPA and CPRA. We may, however, charge a different price or rate, or provide a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to Ardagh Group by your Personal Information.

7. CONTACT US

Call 833-737-0006 or email us at Privacy.NA@ardaghgroup.com to contact us with questions regarding this Notice. California residents who are unable to review or access this Notice due to a disability may describe method to request information contained in the Notice in an alternative format to access this Notice an alternative format.

8. PROSPECTIVE CUSTOMERS AND WEBSITE VISITORS

Categories of Personal Information Collected	Third Parties to Whom We Disclose PI
Identifiers	internal third parties, as set out above external third parties, as set out above third parties to whom we may choose to sell, transfer, or merge parts of our business or assets
Financial Information
Commercial Information
Network Activity Data
Geolocation Data
Professional Information
Inferences

We collect your information for the following purposes:

to register you as a new business partner
to manage our relationship with you, which will include: notifying you about changes to our terms or privacy policy, asking you to leave a review or take a survey
to administer and protect our business and this website, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data
to deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
for marketing purposes, to form a view on what we think you may want, need or be interested in, and to make suggestions and recommendations based on those views
auditing related to current interactions with you including counting ad impressions and unique visitors to our website
to detect security incidents and other fraudulent activity
to monitor and improve our website functionality
to help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business
to comply with a legal or regulatory obligation